create-privacy-policy-ch-en — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-privacy-policy-ch-en (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generates a Swiss-law-compliant Datenschutzerklärung for a website, following the revised nDSG (in force since 01.09.2023) and, where the site targets EU visitors, the DSGVO (GDPR).
Disclaimer: This skill produces a best-effort legal text based on your inputs. It is not a substitute for advice from a Swiss lawyer. For commercial operations or sites processing sensitive data, review with a legal professional.
| Law | Relevance |
|---|---|
| nDSG Art. 19 | Duty to inform data subjects at time of collection |
| nDSG Art. 5 lit. j | Definition of data controller (Verantwortlicher) |
| DSGVO Art. 13/14 | Applies if site targets EU residents — stricter than nDSG |
| DSG Art. 12 | Prohibition of unlawful data processing |
Ask the user:
"Do you already have an Impressum for this website created with create-impressum-ch-en? If yes, I can reuse the identity data directly."If yes → import: name-full / company-name, address, email, website-url If no → collect same fields as Group B of create-impressum-ch-en
Ask each group separately. Wait for answers before proceeding.
"Where is your website hosted?" Examples: GitHub Pages, Netlify, Vercel, Hostpoint, AWS, own server
Store as hosting-provider and hosting-location (country/region if known).
GitHub Pages note: hosted on GitHub (Microsoft) servers, primarily USA. Netlify note: USA. Vercel note: USA. Swiss hosters: Hostpoint, Cyon = CH.
"Does your website load fonts from an external CDN?" Examples: Google Fonts, Adobe Fonts, Bunny Fonts, or self-hosted
Google Fonts loaded via `<link>` tag (standard):
Store as fonts-provider: google-fonts | adobe-fonts | bunny-fonts | self-hosted | none
"Does your website use any analytics or tracking tools?" Examples: Google Analytics, Plausible, Fathom, Matomo, none
| Tool | Data sent to | Cookies | Privacy-friendly |
|---|---|---|---|
| Google Analytics | Google (USA) | yes | no |
| Plausible | EU servers | no | yes |
| Fathom | EU/CA | no | yes |
| Matomo (self-hosted) | own server | optional | yes |
| None | — | — | ✓ |
Store as analytics-tool and analytics-cookies: yes | no | none
"How can visitors contact you? Does the site have any forms?" Examples: email link only, contact form, newsletter signup
| Type | Data collected | Storage |
|---|---|---|
| Email link (mailto:) | none by the site | n/a |
| Contact form | name, email, message | server/email |
| Newsletter | email address | mailing list provider |
Store as contact-method: email-only | contact-form | newsletter | none If form/newsletter: store form-provider (e.g. Formspree, Netlify Forms, Mailchimp)
"Does your website embed or link to any external services that load resources from third-party servers?" Examples: YouTube videos, Vimeo, Google Maps, Claude / AI links, social media buttons, GitHub badges, CDN scripts
Each embed that loads external resources must be disclosed. Claude.ai links (claude.ai/new?q=...) are regular hyperlinks — no data transfer from your server, user clicks voluntarily → no disclosure needed. cdnjs.cloudflare.com scripts → disclose Cloudflare CDN.
Store as embeds[]: list of services
"Does your website set any cookies?"
Purely informational static sites with no analytics and no forms typically set zero cookies. Confirm:
Store as uses-cookies: yes | no If yes: list name, purpose, duration, provider for each cookie.
"Does your website intentionally target visitors in the EU (e.g. German, French, Italian, Austrian audience)?"
If yes → DSGVO Art. 13 disclosure obligations apply in addition to nDSG. The generated policy will include DSGVO-compatible language.
Store as targets-eu: yes | no | unsure (treat as yes if unsure)
"Should the Privacy Policy be in German only, English only, or both languages?"
Store as output-language: de | en | both
Using collected data, generate the policy using the templates in references/template-de.md and/or references/template-en.md.
[bitte ergänzen] / [please add].Google Privacy Policy.
uses-cookies = no: include a short "No cookies" statement — usersappreciate explicit confirmation.
targets-eu = yes: add DSGVO Art. 13 rights block (access, erasure,portability, objection, supervisory authority).
[bitte ergänzen] fields as a checklist."Place this at/datenschutzor/privacyreachable within one click from every page. Link it from your footer next to the Impressum."
"To avoid disclosing Google Fonts IP transfers entirely, self-host your fonts. Download from https://google-webfonts-helper.herokuapp.com and serve from your own domain. Then remove the Google Fonts <link> tag."references/template-de.md — German Datenschutzerklärung templatereferences/template-en.md — English Privacy Policy templatereferences/processing-activities.md — Standard descriptions for commonprocessing activities (hosting, fonts, analytics, forms)
references/rights-blocks.md — nDSG and DSGVO data subject rights blocks~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.